- Email: [email protected]
Quantum cryptography based on wheeler's delayed choice experiment
22 July 1996 PHYSICS LETTERS A
ELSEVIER
Physics L e t ~ A 2 1 7 (1996) 301-304
Quantum cryptography based on Wheeler's delayed choice experiment M. A r d e h a l i
I
Microelectronics Research Laboratories, NEC Corporation, Sagamihara, Kanagawa 229, Japan Received 25 September 1995; revised manuscript received 19 April 1996; accepted for publication 26 April 1996 Communicated by P.R. Holland
Abstract We describe a cryptographic protocol in which Wheeler's delayed choice experiment is used to generate the key distribution. The protocol, which uses photons polarized only along one axis, is secure against general attacks.
In 1970, Wiesner wrote a highly innovative paper about quantum cryptography, introducing a new branch of physics and computation. Unfortunately, his idea went unnoticed, and his paper was not published until 1983 [ 1]. Wiesner's idea was brought back to life in the 1980s primarily by the work of Bennett and Brassard [2]. Bennett et al. have reported the experimental realization of the first quantum cryptographic protocol [3]. Theoretical models for quantum key distributions have been proposed based on the uncertainty principle [2], EPR [4] states [5], and any set of two nonorthogonal states [ 6]. Here we describe a model for the quantum key distribution based on Wheeler's delayed choice experiment. Before proceeding, let us briefly describe Wheeler's delayed choice experiment (for a detailed explanation see Ref. [7], especially Fig. 4; for consistency, we use Wheeler's notations). In the first arrangement, a single photon (or low intensity light pulse) comes in at 1 and encounters a beam splitter ½S which splits it into two beams, 2a and 2b, of equal intensity (see Fig. I E-mail: [email protected].
A
2a i/ l/2S' 2b
/" 2b
(A
B
i/2 S
Fig. 1. Outline of Wheeler's delayed choice experiment.
1). The beams are reflected by the mirrors A and B to a crossing point and are then detected by detectors I and 2. Thus one finds out by which route (2a or 2b) the photon came. In the second arrangement, a beam splitter ½S' is inserted at the point of crossing in front of the detectors. The beams 2a and 2b are brought into constructive interference so that a count is always triggered from detector 1. Thus in this arrangement, one concludes that the photon came by both routes.
0375-9601/96/$12.00 Copyright © 1996 Published by Elsevier Science B.V. All rights reserved. PII S0375-9601 ( 9 6 ) 0 0 3 6 8 - 4
302
M. Ardehali / Physics Letters A 217 (1996) 301-304
rn the new "delayed-choice" version of the experiment one decides whether to put in the half-silvered mirror (beam splitter in front of detectors) or take it out at the very last minute. Thus one decides whether the photon "shall have come by one route, or by both routes" after it has "already done its travel" (quote from Ref. [ 7 ] ). With the above in mind, we now proceed to describe a model for the quantum key distribution. The protocol, which is based on Wheeler's delayed choice experiment, consists of the following steps: ( 1 ) Alice prepares a sequence of N photons (or low intensity light pulses), all polarized in one direction. She randomly inserts the beam splitter ½S in front of her photons. In those instances in which she has 1 not inserted the beam splitter (approximately for 7N photons), she randomly sends the photons along route 2a or 2b. Thus approximately ¼N photons are sent along route 2a, and another ¼N photons are sent along route 2b. (2) Bob randomly (and of course, independent of Alice) inserts his beam splitter ½St in front of his detectors. Thus approximately ½N photons are detected with the beam splitter ½S~in front of the detectors and another ½N photons are detected with the beam splitter removed. (3) Alice tells Bob (and to any adversary who may be listening) in each instance whether she inserted the beam splitter ½S in front of her photon. (4) Bob discards all instances in which he failed to register a particle. He then tests the key distribution by checking that in all instances in which the beam splitters ½S and ½S~ were both inserted, only detector 1 was triggered, i.e., beams 2a and 2b interfered constructively, and in all other instances detectors 1 and 2 were triggered with equal probability. If these conditions are not satisfied, then Bob tells Alice to discard her data and go back to step 1. However, if these conditions are satisfied, then Bob announces publicly to Alice (and to any adversary who may be listening) in each instance whether he inserted the beam splitter ½S~ in front of his detectors and whether he registered a particle. Alice then discards all instances in which Bob failed to register a particle. (5) Alice and Bob discard all instances in which only one of them (either Alice or Bob) inserted the beam splitter. They keep data only from instances in
which they both removed their beam splitters (approximately for ~Nl photons) (6) Alice interprets her data as a binary sequence according to the following coding scheme: the photon is sent along route 2a = 0, the photon is sent along route 2b = 1. The experimental arrangement is such that when the beam splitters are removed, detector 1 (2) is triggered when the photon came by route 2a (2b) (see Fig. 1, and Fig. 4 of Ref. [7] ). Thus Bob interprets his data as a binary sequence according to the following coding scheme: detector 1 is triggered, thus the photon came by route 2a = 0, detector 2 is triggered, thus the photon came by route 2b = 1. (7) A possible strategy for an eavesdropper is to determine by which route the photon has come but then systematically forward to Bob photons passed through a beam splitter. To completely ensure the safety of the key, Alice and Bob should perform parity check [ 3]. They choose a random subset of bit positions and verify that its parity is the same in her and his version. They then discard one bit and choose another random subset to check its parity. If Alice and Bob perform parity check k times, then at the cost of k bits, they can certify (with probability 1 - 2 -~) that their keys are identical (since ¼N photons are in state [2a), ~N l photons are in state [2b), and ½N photons are in a mix of states [2a) and 12b), and since the eavesdropper does not know each photon belongs to which state, any eavesdropping carries the risk of changing the transmission in such a way as to produce disagreement between Alice and Bob on some instances that they think they should agree). We now show that with this coding scheme, Alice and Bob have acquired a random bit sequence with high level of confidence that no one else knows it. We note that Alice and Bob both insert their beam splitters for approximately ¼N instances in which case only detector 1 is triggered. In all other instances detectors 1 and 2 are triggered with equal probability. Thus in the absence of eavesdropping, detector 1 should be triggered for approximately ~ N instances, and detector 2 should be triggered for approximately 3 N instances. We now consider an eavesdropper Eve who detects M photons while they were in transit between Alice
M. Ardehali / Physics Letters A 217 (1996) 301-304
and Bob. Eve has two alternatives: (1) she sends the photons randomly along route 2a or 2b, (2) she inserts a beam splitter in front of the photons. First we assume that Eve does not inserts a beam splitter and forwards the photons randomly along route 2a or 2b. Of the M photons that Eve sends to Bob, for approximately ¼M instances, Alice and Bob have both inserted their beam splitters. In such instances, in the absence of Eve, only detector 1 should be triggered; however, in the presence of Eve, detector 2 is triggered for approximately ½M instances instead of detector 1. Thus Bob should be able to detect the presence of eavesdropping. Next we assume that Eve inserts a beam splitter in front of the M photons. Again of the M photons that Eve sends to Bob, for approximately ¼M instances, Alice has removed her beam splitter and Bob has inserted his beam splitter. Consequently detector 1 is triggered for approximately gM instances more than it should have, i.e., detector 1 is triggered for approximately -~N+ ~M instances and detector 2 is triggered for approximately ~N - ~M instances. Finally we assume that Eve removes the beam splitter for a M photons, and inserts the beam splitter in front of (1 - a ) M photons. Of the c~M photons that Eve sends to Bob, for approximately ¼aM instances, Alice and Bob have both inserted their beam splitter. In such instances, detector 2 is triggered for approximately -~a M instances instead of detector 1. Similarly of the ( 1 - or) M photons that Eve sends to Bob, for approximately ¼( 1 - c~)M instances, Alice has removed her beam splitters and Bob has inserted his beam splitter. Consequently, detector 1 is triggered for approximately ~ N + ~(1 - a ) M instances and detector 2 is triggered for approximately 83-N- 1(1 - a ) M instances. It should be noted that when Eve detects M photons and forwards them randomly along route 2a or 2b without inserting a beam splitter in front of them, Bob should, in general, be able to tell if eavesdropping occurred. In the absence of Eve, whenever Alice and Bob have both inserted their beam splitter, only detector 1 should be triggered; however, in the presence of Eve, sometimes (approximately ~ M instances) detector 2 is triggered instead of detector 1. Thus Bob should be able to detect the presence of eavesdropping. On the other hand, when Eve inserts a beam splitter in front of her M photons and then forwards them to Bob, Bob may not be able to tell if eavesdropping occurred. In
303
BS I/2 S Apcrnat
Polarizer
A ~t
A
Alice's AppQratus
Fig. 2. Proposed cryptographicprotocolbased on Wheeler's delayed choiceexperiment. the absence of Eve, whenever Alice removes her beam splitter and Bob inserts his beam splitter, detectors 1 and 2 should be triggered with equal probability (but at each instance, Bob does not know which detector should be triggered). However, in the presence of Eve, detector 1 is triggered for approximately ~M instances more than it should have, i.e., detector 1 is triggered for approximately ~N + ~M instances and detector 2 is triggered for approximately 3N - ~M instances. Thus if M << N, then Bob may not be able to detect the presence of eavesdropping. For this reason, Alice and Bob should initiate step (7) to completely ensure the security of the protocol. Finally we consider some of the practical problems of the proposed protocol and we propose some modifications that reduce (or perhaps eliminate) these problems. It is, in general, significantly easier to produce dim flashes of light instead of single photons. The problem with faint pulses is that each time more than one photon is sent, Eve gets the opportunity to determine by which route the pulse came. Alice and Bob cannot detect such eavesdropping since Eve lets the other photons of the same pulse continue undisturbed towards Bob. The solution to this problem is a technique called privacy amplification [ 8 ]. Using this technique, Alice and Bob can distill from such a partly secret key, a smaller amount of highly secret key, of which Eve's knowledge is reduced to below any fraction of one bit. It is also, in general, easier for Alice to use three light sources instead of inserting and removing the
304
M. Ardehali / Physics Letters A 217 (1996) 301-304
beam splitter. We therefore consider a cryptographic scheme in which dim flashes of light from three sources A, A ~, and A " are used to generate the key distribution. Alice's sending light source consists of three light emitting diodes that produce faint flashes of light, a pinhole, a lens, and an aperture to collimate the beam, and a horizontal polarizer filter to produce horizontally polarized dim flashes (Fig. 2). Alice inserts a beam splitter only in front of light source A; she then randomly sends ½N dim flashes from i from A t and ¼N from A/~. Bob's the source A, ~N receiving apparatus consists of a beam splitter and detectors 1 and 2. It may be easier for Bob to insert and remove detectors 1 and 2 along routes 2a and 2b instead of inserting and removing the beam splitter. In that case, Bob randomly inserts detectors 1 and 2 along routes 2a and 2b for ½N photons and removes both detectors for ½N photons. A final comment is in order about the advantage of the proposed cryptographic protocol based on Wheeler's delayed choice experiment. In this protocol, all photons are polarized along one axis, for example along the x axis. Since transmission loss depends on polarization, the photons that Alice sends to Bob (perhaps through a fiber) all suffer the same
transmission loss while in transit. In contrast, schemes which use photons polarized in different directions are susceptible to different transmission losses for different photons.
References [1] S. Wiesner, Sigact News 15 (1) (1983) 78. [2] C.H. Bennett and G. Brassard, in: Proc. IEEE Int. Conf. on Computers, systems, and signal processing, Bangalore (IEEE, New York, 1984) p. 175; C.H. Bennett, G. Brassard and A.K. Ekert, Sci. Am. (October 1992) 50. 13] C.H. Bennett, F. Bessette, G. Brassard, L. Salvail and J. Smolin, J. Cryptology 5 (1992) 3. [4] A. Einstein, B. Podolskyand N. Rosen, Phys. Rev. 47 (1935) 777. [5] A.K. Ekert, Phys. Rev. Lett. 67 (1991) 661. [6] C.H. Bennett, Phys. Rev. Lett. 68 (1992) 3121. [7] J.A. Wheeler, in: Mathematical foundations of quantum theory, Proc. New Orleans Conf. on The mathematical foundations of quantumtheory, ed. A.R. Marlow (Academic, New York, 1978) [reprinted in Quantum theory and measurement, eds. J.A. Wheeler and W.H. Zurek (Princeton Univ. Press, Princeton, NJ, 1983) pp. 182-213]. [8] C.H. Bennett, G. Brassard and J.M. Robert, SIAM J. Comput. 17 (1988) 210.
ELSEVIER
Physics L e t ~ A 2 1 7 (1996) 301-304
Quantum cryptography based on Wheeler's delayed choice experiment M. A r d e h a l i
I
Microelectronics Research Laboratories, NEC Corporation, Sagamihara, Kanagawa 229, Japan Received 25 September 1995; revised manuscript received 19 April 1996; accepted for publication 26 April 1996 Communicated by P.R. Holland
Abstract We describe a cryptographic protocol in which Wheeler's delayed choice experiment is used to generate the key distribution. The protocol, which uses photons polarized only along one axis, is secure against general attacks.
In 1970, Wiesner wrote a highly innovative paper about quantum cryptography, introducing a new branch of physics and computation. Unfortunately, his idea went unnoticed, and his paper was not published until 1983 [ 1]. Wiesner's idea was brought back to life in the 1980s primarily by the work of Bennett and Brassard [2]. Bennett et al. have reported the experimental realization of the first quantum cryptographic protocol [3]. Theoretical models for quantum key distributions have been proposed based on the uncertainty principle [2], EPR [4] states [5], and any set of two nonorthogonal states [ 6]. Here we describe a model for the quantum key distribution based on Wheeler's delayed choice experiment. Before proceeding, let us briefly describe Wheeler's delayed choice experiment (for a detailed explanation see Ref. [7], especially Fig. 4; for consistency, we use Wheeler's notations). In the first arrangement, a single photon (or low intensity light pulse) comes in at 1 and encounters a beam splitter ½S which splits it into two beams, 2a and 2b, of equal intensity (see Fig. I E-mail: [email protected].
A
2a i/ l/2S' 2b
/" 2b
(A
B
i/2 S
Fig. 1. Outline of Wheeler's delayed choice experiment.
1). The beams are reflected by the mirrors A and B to a crossing point and are then detected by detectors I and 2. Thus one finds out by which route (2a or 2b) the photon came. In the second arrangement, a beam splitter ½S' is inserted at the point of crossing in front of the detectors. The beams 2a and 2b are brought into constructive interference so that a count is always triggered from detector 1. Thus in this arrangement, one concludes that the photon came by both routes.
0375-9601/96/$12.00 Copyright © 1996 Published by Elsevier Science B.V. All rights reserved. PII S0375-9601 ( 9 6 ) 0 0 3 6 8 - 4
302
M. Ardehali / Physics Letters A 217 (1996) 301-304
rn the new "delayed-choice" version of the experiment one decides whether to put in the half-silvered mirror (beam splitter in front of detectors) or take it out at the very last minute. Thus one decides whether the photon "shall have come by one route, or by both routes" after it has "already done its travel" (quote from Ref. [ 7 ] ). With the above in mind, we now proceed to describe a model for the quantum key distribution. The protocol, which is based on Wheeler's delayed choice experiment, consists of the following steps: ( 1 ) Alice prepares a sequence of N photons (or low intensity light pulses), all polarized in one direction. She randomly inserts the beam splitter ½S in front of her photons. In those instances in which she has 1 not inserted the beam splitter (approximately for 7N photons), she randomly sends the photons along route 2a or 2b. Thus approximately ¼N photons are sent along route 2a, and another ¼N photons are sent along route 2b. (2) Bob randomly (and of course, independent of Alice) inserts his beam splitter ½St in front of his detectors. Thus approximately ½N photons are detected with the beam splitter ½S~in front of the detectors and another ½N photons are detected with the beam splitter removed. (3) Alice tells Bob (and to any adversary who may be listening) in each instance whether she inserted the beam splitter ½S in front of her photon. (4) Bob discards all instances in which he failed to register a particle. He then tests the key distribution by checking that in all instances in which the beam splitters ½S and ½S~ were both inserted, only detector 1 was triggered, i.e., beams 2a and 2b interfered constructively, and in all other instances detectors 1 and 2 were triggered with equal probability. If these conditions are not satisfied, then Bob tells Alice to discard her data and go back to step 1. However, if these conditions are satisfied, then Bob announces publicly to Alice (and to any adversary who may be listening) in each instance whether he inserted the beam splitter ½S~ in front of his detectors and whether he registered a particle. Alice then discards all instances in which Bob failed to register a particle. (5) Alice and Bob discard all instances in which only one of them (either Alice or Bob) inserted the beam splitter. They keep data only from instances in
which they both removed their beam splitters (approximately for ~Nl photons) (6) Alice interprets her data as a binary sequence according to the following coding scheme: the photon is sent along route 2a = 0, the photon is sent along route 2b = 1. The experimental arrangement is such that when the beam splitters are removed, detector 1 (2) is triggered when the photon came by route 2a (2b) (see Fig. 1, and Fig. 4 of Ref. [7] ). Thus Bob interprets his data as a binary sequence according to the following coding scheme: detector 1 is triggered, thus the photon came by route 2a = 0, detector 2 is triggered, thus the photon came by route 2b = 1. (7) A possible strategy for an eavesdropper is to determine by which route the photon has come but then systematically forward to Bob photons passed through a beam splitter. To completely ensure the safety of the key, Alice and Bob should perform parity check [ 3]. They choose a random subset of bit positions and verify that its parity is the same in her and his version. They then discard one bit and choose another random subset to check its parity. If Alice and Bob perform parity check k times, then at the cost of k bits, they can certify (with probability 1 - 2 -~) that their keys are identical (since ¼N photons are in state [2a), ~N l photons are in state [2b), and ½N photons are in a mix of states [2a) and 12b), and since the eavesdropper does not know each photon belongs to which state, any eavesdropping carries the risk of changing the transmission in such a way as to produce disagreement between Alice and Bob on some instances that they think they should agree). We now show that with this coding scheme, Alice and Bob have acquired a random bit sequence with high level of confidence that no one else knows it. We note that Alice and Bob both insert their beam splitters for approximately ¼N instances in which case only detector 1 is triggered. In all other instances detectors 1 and 2 are triggered with equal probability. Thus in the absence of eavesdropping, detector 1 should be triggered for approximately ~ N instances, and detector 2 should be triggered for approximately 3 N instances. We now consider an eavesdropper Eve who detects M photons while they were in transit between Alice
M. Ardehali / Physics Letters A 217 (1996) 301-304
and Bob. Eve has two alternatives: (1) she sends the photons randomly along route 2a or 2b, (2) she inserts a beam splitter in front of the photons. First we assume that Eve does not inserts a beam splitter and forwards the photons randomly along route 2a or 2b. Of the M photons that Eve sends to Bob, for approximately ¼M instances, Alice and Bob have both inserted their beam splitters. In such instances, in the absence of Eve, only detector 1 should be triggered; however, in the presence of Eve, detector 2 is triggered for approximately ½M instances instead of detector 1. Thus Bob should be able to detect the presence of eavesdropping. Next we assume that Eve inserts a beam splitter in front of the M photons. Again of the M photons that Eve sends to Bob, for approximately ¼M instances, Alice has removed her beam splitter and Bob has inserted his beam splitter. Consequently detector 1 is triggered for approximately gM instances more than it should have, i.e., detector 1 is triggered for approximately -~N+ ~M instances and detector 2 is triggered for approximately ~N - ~M instances. Finally we assume that Eve removes the beam splitter for a M photons, and inserts the beam splitter in front of (1 - a ) M photons. Of the c~M photons that Eve sends to Bob, for approximately ¼aM instances, Alice and Bob have both inserted their beam splitter. In such instances, detector 2 is triggered for approximately -~a M instances instead of detector 1. Similarly of the ( 1 - or) M photons that Eve sends to Bob, for approximately ¼( 1 - c~)M instances, Alice has removed her beam splitters and Bob has inserted his beam splitter. Consequently, detector 1 is triggered for approximately ~ N + ~(1 - a ) M instances and detector 2 is triggered for approximately 83-N- 1(1 - a ) M instances. It should be noted that when Eve detects M photons and forwards them randomly along route 2a or 2b without inserting a beam splitter in front of them, Bob should, in general, be able to tell if eavesdropping occurred. In the absence of Eve, whenever Alice and Bob have both inserted their beam splitter, only detector 1 should be triggered; however, in the presence of Eve, sometimes (approximately ~ M instances) detector 2 is triggered instead of detector 1. Thus Bob should be able to detect the presence of eavesdropping. On the other hand, when Eve inserts a beam splitter in front of her M photons and then forwards them to Bob, Bob may not be able to tell if eavesdropping occurred. In
303
BS I/2 S Apcrnat
Polarizer
A ~t
A
Alice's AppQratus
Fig. 2. Proposed cryptographicprotocolbased on Wheeler's delayed choiceexperiment. the absence of Eve, whenever Alice removes her beam splitter and Bob inserts his beam splitter, detectors 1 and 2 should be triggered with equal probability (but at each instance, Bob does not know which detector should be triggered). However, in the presence of Eve, detector 1 is triggered for approximately ~M instances more than it should have, i.e., detector 1 is triggered for approximately ~N + ~M instances and detector 2 is triggered for approximately 3N - ~M instances. Thus if M << N, then Bob may not be able to detect the presence of eavesdropping. For this reason, Alice and Bob should initiate step (7) to completely ensure the security of the protocol. Finally we consider some of the practical problems of the proposed protocol and we propose some modifications that reduce (or perhaps eliminate) these problems. It is, in general, significantly easier to produce dim flashes of light instead of single photons. The problem with faint pulses is that each time more than one photon is sent, Eve gets the opportunity to determine by which route the pulse came. Alice and Bob cannot detect such eavesdropping since Eve lets the other photons of the same pulse continue undisturbed towards Bob. The solution to this problem is a technique called privacy amplification [ 8 ]. Using this technique, Alice and Bob can distill from such a partly secret key, a smaller amount of highly secret key, of which Eve's knowledge is reduced to below any fraction of one bit. It is also, in general, easier for Alice to use three light sources instead of inserting and removing the
304
M. Ardehali / Physics Letters A 217 (1996) 301-304
beam splitter. We therefore consider a cryptographic scheme in which dim flashes of light from three sources A, A ~, and A " are used to generate the key distribution. Alice's sending light source consists of three light emitting diodes that produce faint flashes of light, a pinhole, a lens, and an aperture to collimate the beam, and a horizontal polarizer filter to produce horizontally polarized dim flashes (Fig. 2). Alice inserts a beam splitter only in front of light source A; she then randomly sends ½N dim flashes from i from A t and ¼N from A/~. Bob's the source A, ~N receiving apparatus consists of a beam splitter and detectors 1 and 2. It may be easier for Bob to insert and remove detectors 1 and 2 along routes 2a and 2b instead of inserting and removing the beam splitter. In that case, Bob randomly inserts detectors 1 and 2 along routes 2a and 2b for ½N photons and removes both detectors for ½N photons. A final comment is in order about the advantage of the proposed cryptographic protocol based on Wheeler's delayed choice experiment. In this protocol, all photons are polarized along one axis, for example along the x axis. Since transmission loss depends on polarization, the photons that Alice sends to Bob (perhaps through a fiber) all suffer the same
transmission loss while in transit. In contrast, schemes which use photons polarized in different directions are susceptible to different transmission losses for different photons.
References [1] S. Wiesner, Sigact News 15 (1) (1983) 78. [2] C.H. Bennett and G. Brassard, in: Proc. IEEE Int. Conf. on Computers, systems, and signal processing, Bangalore (IEEE, New York, 1984) p. 175; C.H. Bennett, G. Brassard and A.K. Ekert, Sci. Am. (October 1992) 50. 13] C.H. Bennett, F. Bessette, G. Brassard, L. Salvail and J. Smolin, J. Cryptology 5 (1992) 3. [4] A. Einstein, B. Podolskyand N. Rosen, Phys. Rev. 47 (1935) 777. [5] A.K. Ekert, Phys. Rev. Lett. 67 (1991) 661. [6] C.H. Bennett, Phys. Rev. Lett. 68 (1992) 3121. [7] J.A. Wheeler, in: Mathematical foundations of quantum theory, Proc. New Orleans Conf. on The mathematical foundations of quantumtheory, ed. A.R. Marlow (Academic, New York, 1978) [reprinted in Quantum theory and measurement, eds. J.A. Wheeler and W.H. Zurek (Princeton Univ. Press, Princeton, NJ, 1983) pp. 182-213]. [8] C.H. Bennett, G. Brassard and J.M. Robert, SIAM J. Comput. 17 (1988) 210.